Malware · 1 source · latest 3d

NetamLoader malware hidden in Windows update files targets Asian governments

MALWAREKasperskyredteam/daily · 1 source

Severity: High
Sources: 1

What happened

Kaspersky researchers have identified NetamLoader, a .NET loading framework built on XAML markup, which appears to be a supply-chain attack on a customised Windows build used only by Asian government bodies. Kaspersky Security Network flagged a .config file that used AppDomainManager injection to load the malware. No known APT group has been linked to the campaign.

For IT people · Written by AI from 1 source · Wrong?

What to do

Review .config files in .NET applications for unexpected AppDomainManager entries.
Check whether your systems use customised Windows builds and verify their update sources.

Written by AI from the sources, checked against them

Read the full story at the source